AWS OpenSearch Service认证/授权失败问题排查求助

问题场景 #

尝试通过OpenSearch Java客户端连接AWS OpenSearch域，已配置AWS环境变量，但抛出[security_exception] authentication/authorization failure错误。

客户端代码 #

public class Example {

  public static void main(final String[] args) throws IOException {
    SdkHttpClient httpClient = ApacheHttpClient.builder().build();
    try {
      OpenSearchClient client =
          new OpenSearchClient(
              new AwsSdk2Transport(
                  httpClient,
                  "search-*****-3ovub4o4gncugluu6t2tquptnu.eu-central-1.es.amazonaws.com",
                  Region.EU_CENTRAL_1,
                  AwsSdk2TransportOptions.builder().build()));

      InfoResponse info = client.info();
      System.out.println(info.version().distribution() + ": " + info.version().number());
    } finally {
      httpClient.close();
    }
  }
}

抛出异常 #

Exception in thread "main" org.opensearch.client.opensearch._types.OpenSearchException: Request failed: [security_exception] authentication/authorization failureat org.opensearch.client.transport.aws.AwsSdk2Transport.parseResponse(AwsSdk2Transport.java:47)at org.opensearch.client.transport.aws.AwsSdk2Transport.executeSync(AwsSdk2Transport.java:393)at org.opensearch.client.transport.aws.AwsSdk2Transport.performRequest(AwsSdk2Transport.java:191)at org.opensearch.client.opensearch.OpenSearchClient.info(OpenSearchClient.java:790)at Example.main(Example.java:25)

排查步骤 #

• 验证IAM用户权限范围
  确保IAM用户拥有es:ESHttpGet权限，且策略资源ARN精确到目标域的所有路径。示例策略：

  {
    "Version": "2012-10-17",
    "Statement": [
      {
        "Effect": "Allow",
        "Action": "es:ESHttpGet",
        "Resource": "arn:aws:es:eu-central-1:你的AWS账号ID:domain/你的域名称/*"
      }
    ]
  }
  

  注意：仅配置IAM权限不够，还需同步配置OpenSearch域的访问策略。

• 确认AWS凭证加载有效性
  代码默认按顺序加载凭证（环境变量→系统属性→实例角色等），可通过以下方式排查：

  1. 打印System.getenv("AWS_ACCESS_KEY_ID")验证环境变量是否在运行环境中正确加载；
  2. 显式指定凭证提供者，强制使用环境变量或配置文件凭证，示例：

     AwsCredentialsProvider credentialsProvider = EnvironmentVariableCredentialsProvider.create();
     OpenSearchClient client = new OpenSearchClient(
         new AwsSdk2Transport(
             httpClient,
             "search-*****-3ovub4o4gncugluu6t2tquptnu.eu-central-1.es.amazonaws.com",
             Region.EU_CENTRAL_1,
             AwsSdk2TransportOptions.builder()
                 .credentialsProvider(credentialsProvider)
                 .build()));
     

• 检查OpenSearch域访问策略
  域的访问策略需明确允许目标IAM用户执行对应操作，示例策略：

  {
    "Version": "2012-10-17",
    "Statement": [
      {
        "Effect": "Allow",
        "Principal": {
          "AWS": "arn:aws:iam::你的AWS账号ID:user/你的IAM用户名"
        },
        "Action": "es:ESHttpGet",
        "Resource": "arn:aws:es:eu-central-1:你的AWS账号ID:domain/你的域名称/*"
      }
    ]
  }
  

• 排查精细访问控制配置
  如果域启用了精细访问控制（Fine-Grained Access Control），需在OpenSearch Security插件中为该IAM用户（或对应的后端角色）分配集群级权限（如cluster_monitor），允许其访问集群信息。

• 核对端点与区域
  确认代码中的域端点未包含https://前缀，且Region参数与域所在区域完全匹配（如Region.EU_CENTRAL_1对应eu-central-1区域）。

• 检查依赖版本兼容性
  确保opensearch-java和opensearch-transport-aws依赖版本与AWS OpenSearch域的主版本一致（如域为2.x，则客户端也使用2.x系列），避免版本不匹配导致的签名或协议冲突。

内容的提问来源于stack exchange，提问作者Taras Vovk